Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the lack of JWT authentication middleware and RBAC authorization checks in the routing configuration for /api/v1/jobs endpoint. An attacker can view, update, and delete jobs by sending...

D-link DIR-823X Router Arbitrary Command Execution

The vulnerability of the sub412E7C function in D-link DIR-823X router microprogramming software is related to the failure to take measures to neutralize special elements during the processing of the wdenable parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

CVE-2021-47854

CVE-2021-47854 affects DD-WRT 45723 and describes a buffer overflow in the UPNP network discovery service. The vulnerability is triggered by receiving crafted M-SEARCH packets with oversized UUID payloads, which can lead to remote code execution on the targeted device. The CVSS metrics indicate a...

CVE-2021-47802

CVE-2021-47802 affects Tenda D151 and D301 routers. The issue is an unauthenticated configuration download vulnerability reachable via /goform/getimage, permitting remote attackers to retrieve router configuration data, including admin credentials. The provided connected sources corroborate the v...

CVE-2021-47802

Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without...

EUVD-2026-3650

Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without...

CVE-2021-47802 Tenda D151 & D301 - Configuration Download

Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files. Attackers can send a request to /goform/getimage endpoint to download configuration data including admin credentials without...

UTT 520W Router strcpy() Code Execution

The vulnerability of the strcpy function in the UTT 520W router’s microprogramming system is related to the operation of writing data outside the buffer during the processing of the hidcontact parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a...

CVE-2025-70650

The Tenda AX-1806 Wi-Fi6 wireless router (version 1.0.0.1 ) contains a stack-based buffer overflow vulnerability within the deviceList parameter of the formSetMacFilterCfg function in its microprogramming software. A remote attacker can exploit this flaw by sending a crafted request to cause a De...

EUVD-2026-3604

Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code execution...

CVE-2025-70651

Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow in the ssid parameter of the formfastsettingwifiset function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

Tenda AX1803 security vulnerabilities

The Tenda AX1803 is a dual-band Gigabit WIFI6 router produced by the Chinese company Tenda. The Tenda AX1803 v1.0.0.1 version contains a security vulnerability. This vulnerability stems from a stack overflow in the security5g parameter within the sub727F4 function, which may lead to a...

CVE-2025-55423

A command injection vulnerability exists in the upnprelay function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system without proper validation or sanitization, allowing OS command injection...

@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)

Summary A security vulnerability exists in @fastify/express where middleware registered with a specific path prefix can be bypassed using URL-encoded characters e.g., /%61dmin instead of /admin. While the middleware engine fails to match the encoded path and skips execution, the underlying Fastif...

CVE-2026-1156

A vulnerability was determined in Totolink LR350 9.3.5u.6369B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been...

UTT 520W strcpy Heap Buffer Overflow DoS

The vulnerability of the strcpy function in the microprogrammed routing device UTT 520W is related to the output of the operation beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially crafted POST...

UTT 520W strcpy Heap Buffer Overflow DoS

The vulnerability of the strcpy function in the microprogrammed routing device UTT 520W is related to the output of the operation beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially crafted POST...

TOTOLINK LR350 Router Command Execution

The vulnerability of the setTracerouteCfg function in TOTOLINK LR350 router microprogramming software is related to the lack of measures taken to clean up data at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

UTT 520W Router strcpy Buffer Overflow DoS

The vulnerability of the strcpy function in the /goform/formTaskEdit file of the UTT 520W microprogramming router software is related to the escape of the operation beyond the buffer in memory when processing the selDateType parameter. Exploiting this vulnerability could allow a remote attacker t...

UTT 520W strcpy Heap Buffer Overflow DoS

The vulnerability of the strcpy function in the UTT 520W router microprogramming system is related to the output of the operation being sent out of the buffer into memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially crafted POST...